summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-09-09upstream: adapt to SSH_SK_VERSION_MAJOR crankdjm@openbsd.org
OpenBSD-Regress-ID: 0f3e76bdc8f9dbd9d22707c7bdd86051d5112ab8
2020-09-09upstream: Ensure that address/mask mismatches are flagged atdtucker@openbsd.org
config-check time. ok djm@ OpenBSD-Regress-ID: 8f5f4c2c0bf00e6ceae7a1755a444666de0ea5c2
2020-09-09upstream: when writing an attestation blob for a FIDO key, record alldjm@openbsd.org
the data needed to verify the attestation. Previously we were missing the "authenticator data" that is included in the signature. spotted by Ian Haken feedback Pedro Martelletto and Ian Haken; ok markus@ OpenBSD-Commit-ID: 8439896e63792b2db99c6065dd9a45eabbdb7e0a
2020-09-02configure.ac: fix libfido2 back-compatpedro martelletto
- HAVE_FIDO_CRED_PROD -> HAVE_FIDO_CRED_PROT; - check for fido_dev_get_touch_begin(), so that HAVE_FIDO_DEV_GET_TOUCH_BEGIN gets defined.
2020-08-31upstream: refuse to add verify-required (PINful) FIDO keys todjm@openbsd.org
ssh-agent until the agent supports them properly OpenBSD-Commit-ID: 125bd55a8df32c87c3ec33c6ebe437673a3d037e
2020-08-31upstream: Add RCS IDs to the few files that are missing them; fromdjm@openbsd.org
Pedro Martelletto OpenBSD-Commit-ID: 39aa37a43d0c75ec87f1659f573d3b5867e4a3b3
2020-08-31upstream: Check that the addresses supplied to Match Address anddtucker@openbsd.org
Match LocalAddress are valid when parsing in config-test mode. This will catch address/mask mismatches before they cause problems at runtime. Found by Daniel Stocker, ok djm@ OpenBSD-Commit-ID: 2d0b10c69fad5d8fda4c703e7c6804935289378b
2020-08-31upstream: sentence fix; from pedro martellettojmc@openbsd.org
OpenBSD-Commit-ID: f95b84a1e94e9913173229f3787448eea2f8a575
2020-08-27tweak back-compat for older libfido2Damien Miller
2020-08-27upstream: debug()-print a little info about FIDO-specific keydjm@openbsd.org
fields via "ssh-keygen -vyf /path/key" OpenBSD-Commit-ID: cf315c4fe77db43947d111b00155165cb6b577cf
2020-08-27upstream: skip a bit more FIDO token selection logic when only adjm@openbsd.org
single token is attached. with Pedro Martelletto OpenBSD-Commit-ID: e4a324bd9814227ec1faa8cb619580e661cca9ac
2020-08-27upstream: tweak previous;jmc@openbsd.org
OpenBSD-Commit-ID: 92714b6531e244e4da401b2defaa376374e24be7
2020-08-27upstream: adapt to API changesdjm@openbsd.org
OpenBSD-Regress-ID: 5f147990cb67094fe554333782ab268a572bb2dd
2020-08-27degrade semi-gracefully when libfido2 is too oldDamien Miller
2020-08-27upstream: dummy firmware needs to match API version numner crank (fordjm@openbsd.org
verify-required resident keys) even though it doesn't implement this feature OpenBSD-Regress-ID: 86579ea2891e18e822e204413d011b2ae0e59657
2020-08-27upstream: remove unreachable code I forgot to delete in r1.334djm@openbsd.org
OpenBSD-Commit-ID: 9ed6078251a0959ee8deda443b9ae42484fd8b18
2020-08-27upstream: Request PIN ahead of time for certain FIDO actionsdjm@openbsd.org
When we know that a particular action will require a PIN, such as downloading resident keys or generating a verify-required key, request the PIN before attempting it. joint work with Pedro Martelletto; ok markus@ OpenBSD-Commit-ID: 863182d38ef075bad1f7d20ca485752a05edb727
2020-08-27upstream: preserve verify-required for resident FIDO keysdjm@openbsd.org
When downloading a resident, verify-required key from a FIDO token, preserve the verify-required in the private key that is written to disk. Previously we weren't doing that because of lack of support in the middleware API. from Pedro Martelletto; ok markus@ and myself OpenBSD-Commit-ID: 201c46ccdd227cddba3d64e1bdbd082afa956517
2020-08-27upstream: major rework of FIDO token selection logicdjm@openbsd.org
When PINs are in use and multiple FIDO tokens are attached to a host, we cannot just blast requests at all attached tokens with the PIN specified as this will cause the per-token PIN failure counter to increment. If this retry counter hits the token's limit (usually 3 attempts), then the token will lock itself and render all (web and SSH) of its keys invalid. We don't want this. So this reworks the key selection logic for the specific case of multiple keys being attached. When multiple keys are attached and the operation requires a PIN, then the user must touch the key that they wish to use first in order to identify it. This may require multiple touches, but only if there are multiple keys attached AND (usually) the operation requires a PIN. The usual case of a single key attached should be unaffected. Work by Pedro Martelletto; ok myself and markus@ OpenBSD-Commit-ID: 637d3049ced61b7a9ee796914bbc4843d999a864
2020-08-27upstream: support for requiring user verified FIDO keys in sshddjm@openbsd.org
This adds a "verify-required" authorized_keys flag and a corresponding sshd_config option that tells sshd to require that FIDO keys verify the user identity before completing the signing/authentication attempt. Whether or not user verification was performed is already baked into the signature made on the FIDO token, so this is just plumbing that flag through and adding ways to require it. feedback and ok markus@ OpenBSD-Commit-ID: 3a2313aae153e043d57763d766bb6d55c4e276e6
2020-08-27upstream: support for user-verified FIDO keysdjm@openbsd.org
FIDO2 supports a notion of "user verification" where the user is required to demonstrate their identity to the token before particular operations (e.g. signing). Typically this is done by authenticating themselves using a PIN that has been set on the token. This adds support for generating and using user verified keys where the verification happens via PIN (other options might be added in the future, but none are in common use now). Practically, this adds another key generation option "verify-required" that yields a key that requires a PIN before each authentication. feedback markus@ and Pedro Martelletto; ok markus@ OpenBSD-Commit-ID: 57fd461e4366f87c47502c5614ec08573e6d6a15
2020-08-27upstream: ssh-keyscan(1): simplify conloop() with timercmp(3),cheloha@openbsd.org
timersub(3); ok djm@ OpenBSD-Commit-ID: a102acb544f840d33ad73d40088adab4a687fa27
2020-08-27upstream: let ssh_config(5)'s AddKeysToAgent keyword accept a timedjm@openbsd.org
limit for keys in addition to its current flag options. Time-limited keys will automatically be removed from ssh-agent after their expiry time has passed; ok markus@ OpenBSD-Commit-ID: 792e71cacbbc25faab5424cf80bee4a006119f94
2020-08-27upstream: let the "Confirm user presence for key ..." ssh-askpassdjm@openbsd.org
notification respect $SSH_ASKPASS_REQUIRE; ok markus@ OpenBSD-Commit-ID: 7c1a616b348779bda3b9ad46bf592741f8e206c1
2020-08-21Remove check for 'ent' command.Darren Tucker
It was added in 8d1fd57a9 for measuring entropy of ssh_prng_cmds which has long since been removed and there are no other references to it.
2020-08-17Wrap stdint.h include in ifdef HAVE_STDINT_H.Darren Tucker
2020-08-10sync memmem.c with OpenBSDDamien Miller
2020-08-07Always send any PAM account messages.Darren Tucker
If the PAM account stack reaturns any messages, send them to the user not just if the check succeeds. bz#2049, ok djm@
2020-08-07Output test debug logs on failure.Darren Tucker
2020-08-07Add ability to specify exact test target.Darren Tucker
2020-08-07Document --without-openssl and --without-zlib.Darren Tucker
2020-08-07Add without-openssl without-zlib test target.Darren Tucker
2020-08-06Add CI with prepare scriptStefan Schindler
* Only use heimdal kerberos implementation * Fetch yubico/libfido2 (see: https://github.com/Yubico/libfido2) * Add one target for * all features * each feature alone * no features
2020-08-05support NetBSD's utmpx.ut_ss address fieldDamien Miller
bz#960, ok dtucker
2020-08-04wrap a declaration in the same ifdefs as its useDamien Miller
avoids warnings on NetBSD
2020-08-04undef TAILQ_CONCAT and friendsDamien Miller
Needed for NetBSD. etc that supply these macros
2020-08-03upstream: ensure that certificate extensions are lexically sorted.djm@openbsd.org
Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz3198 ok dtucker markus OpenBSD-Commit-ID: d97deb90587b06cb227c66ffebb2d9667bf886f0
2020-08-03upstream: allow -A to explicitly enable agent forwarding in scp anddjm@openbsd.org
sftp. The default remains to not forward an agent, even when ssh_config enables it. ok jmc dtucker markus OpenBSD-Commit-ID: 36cc526aa3b0f94e4704b8d7b969dd63e8576822
2020-08-03upstream: clang -Wimplicit-fallthrough does not recognise /*deraadt@openbsd.org
FALLTHROUGH */ comments, which is the style we currently use, and gives too many boring warnings. ok djm OpenBSD-Commit-ID: 07b5031e9f49f2b69ac5e85b8da4fc9e393992a0
2020-08-03upstream: Also compare username when checking for JumpHost loops.dtucker@openbsd.org
bz#3057, ok djm@ OpenBSD-Commit-ID: 9bbc1d138adb34c54f3c03a15a91f75dbf418782
2020-07-31Remove AC_REVISION.Darren Tucker
It hasn't been useful since we switched to git in 2014. ok djm@
2020-07-28Use argv in OSSH_CHECK_CFLAG_COMPILE test.Darren Tucker
configure.ac is not detecting -Wextra in compilers that implement the option. The problem is that -Wextra implies -Wunused-parameter, and the C excerpt used by aclocal.m4 does not use argv. Patch from pedro at ambientworks.net, ok djm@
2020-07-20Skip ECDSA-SK webauthn test when built w/out ECCDarren Tucker
2020-07-20Add ssh-sk-helper and manpage to RPM spec fileDamien Miller
Based on patch from Fabio Pedretti
2020-07-17upstream: Add %k to the TOKENs for Match Exec for consistency withdtucker@openbsd.org
the other keywords that recently got %k. OpenBSD-Commit-ID: 1857d1c40f270cbc254fca91e66110641dddcfdb
2020-07-17upstream: fix macro slip in previous;jmc@openbsd.org
OpenBSD-Commit-ID: 624e47ab209450ad9ad5c69f54fa69244de5ed9a
2020-07-17upstream: Add test for '%k' (HostKeyAlias) TOKEN.dtucker@openbsd.org
OpenBSD-Regress-ID: 8ed1ba1a811790031aad3fcea860a34ad7910456
2020-07-17upstream: Add tests for expansions on UserKnownHostsFile.dtucker@openbsd.org
OpenBSD-Regress-ID: bccf8060306c841bbcceb1392644f906a4d6ca51
2020-07-17upstream: log error message for process_write() write failuresdjm@openbsd.org
OpenBSD-Commit-ID: f733d7b3b05e3c68967dc18dfe39b9e8fad29851
2020-07-17upstream: Add a '%k' TOKEN that expands to the effective HostKey ofdtucker@openbsd.org
the destination. This allows, eg, keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654, ok djm@, jmc@ (man page bits) OpenBSD-Commit-ID: 7084d723c9cc987a5c47194219efd099af5beadc
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-29 21:15:49 +0000